WordPress Security Checklist (30 Steps for 2026)
A checklist beats good intentions. This 30-step WordPress security checklist for 2026 is grouped so you can work through it in an afternoon and close the gaps behind almost every WordPress hack — from updates and login to file permissions, headers and monitoring.
Baseline your site first: run a free MageArgus scan to see versions, exposed files and headers, then tick off the rest below.
- Updates + login hardening prevent the majority of real WordPress compromises — WPScan / Sucuri
- Blocking PHP in uploads neutralises the most common backdoor location — MageArgus
Updates & components
- Core auto-updates for minor releases enabled.
- All plugins and themes current; unused ones deleted (not just deactivated).
- No nulled/pirated plugins or themes.
- Remove abandoned plugins (no update in 12+ months).
Login & users
- Strong, unique admin passwords.
- Two-factor authentication for all admins.
- Limit login attempts; protect
wp-login.php. - No user named
admin; least-privilege roles. - Remove unused accounts.
wp-config & files
- Fresh security keys/salts.
DISALLOW_FILE_EDITset to true.- Files 644, directories 755,
wp-config.php600. - Block PHP execution in
wp-content/uploads. - Disable directory listing.
Transport & headers
- HTTPS everywhere with HSTS.
- CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy set.
- Secure, HttpOnly cookies.
Backups & monitoring
- Automated, off-site, tested backups.
- File-integrity monitoring.
- Scheduled malware scans.
- Alerts on new admin users and file changes.
Hosting & extras
- Reputable host with isolation and PHP kept current.
- Disable XML-RPC if unused.
- Hide version info where practical.
- Have a recovery plan and know where backups are.
Deep-dive on the trickiest items in wp-config hardening.
Frequently asked questions
How often should I run through this checklist?
Do the full pass once, then re-check updates weekly and revisit the whole list quarterly and after any major change. Backups and monitoring should run continuously.
Which items matter most?
Updates, two-factor auth, blocking PHP in uploads, and tested backups. Those four alone stop or contain most WordPress attacks; the rest reduce your remaining exposure.